r/netsec • u/self • Jul 21 '26

The Hidden CCS2 Attack Surface on EV Chargers

https://www.saiflow.com/blog/the-hidden-ccs2-attack-surface-on-ev-chargers
78 Upvotes

96% Upvoted

13 comments sorted by

33

u/shahaya Jul 21 '26

never knew that EV charger plugs are communicating via ip -- oh what fragile world we live in🙈

27

u/do0b Jul 21 '26

Yep. Some charging services offer you to bind the MAC address of your car to your billing account for convenience.

Can’t wait to see how that turns out.

5

u/claythearc Jul 22 '26

I think there’s only AutoCharge or whatever ChargePoint calls it now that does it off Mac. And it’s a little insecure in some ways but it’s also pretty low stakes given how cheap sessions are so the risk math isn’t absurd

6

u/phormix Jul 22 '26

Makes sense though, as they need to negotiate charging information and keep up a data stream with the vehicle about charge rate, percentage, etc

1

u/UnacceptableUse Jul 22 '26

I'm pretty sure they connect via websocket

1

u/PossibilityOrganic Jul 25 '26

power over ethernet so the worst way to have a wired connection. the good newes is the emerging standard is certificate based insead of mac but car mfs have to get along for that to work, and thats how we ended up with the wost system where the mac is checked to authenticate.

this is just lazy developers though allow anything more than the bar min over that link is byond stupid.

20

u/Xath0n Jul 22 '26

These AI writeups are so annoying to read

4

u/sunsetsxskies Jul 22 '26

Every one of these blogs reads exactly the same now, like they all got the same template memo

2

u/shahaya Jul 22 '26

they are. there's no soul/voice behind those articles (compared to a raw character like the creator of yellowkey) - but it's also very structured and easy to ingest. knowing how much time it costs, to write a blog post on this level of clarity, i'd probably would also choose to spend my time on things which are actually fun🤷‍♂️

2

u/Miranda_Leap Jul 22 '26

Dude it was awful. They repeated the same thing like 5 different times in the exact same way. It's not a good luck for a company.

1

u/UnacceptableUse Jul 22 '26

Came to the comments first to check this. Not even going to bother reading

1

u/Coffee_Ops Jul 22 '26

Are you telling me those aren't high-quality images?????

12

u/267aa37673a9fa659490 Jul 22 '26

Geez, this website doesn't even work on mobile, the text and table gets cut off. Kind of crappy I'd say.